From 8202a7f48f6e6cca3d43387c123500a5bb4440aa Mon Sep 17 00:00:00 2001
From: Delta-Sierra <deborah.servili@gmail.com>
Date: Thu, 15 Sep 2022 15:39:47 +0200
Subject: [PATCH] Add PlugX ref

---
 clusters/rat.json | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/clusters/rat.json b/clusters/rat.json
index dd42ee54..c87ed04e 100644
--- a/clusters/rat.json
+++ b/clusters/rat.json
@@ -1941,7 +1941,8 @@
         "date": "2005 or 2008",
         "refs": [
           "https://www.lastline.com/labsblog/an-analysis-of-plugx-malware/",
-          "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/PLUGX"
+          "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/PLUGX",
+          "https://secjoes-reports.s3.eu-central-1.amazonaws.com/Dissecting+PlugX+to+Extract+Its+Crown+Jewels.pdf"
         ],
         "synonyms": [
           "Korplug",
@@ -3536,5 +3537,5 @@
       "value": "Ragnatela"
     }
   ],
-  "version": 39
+  "version": 40
 }